This Week in Spring - May 17th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! I am in beautiful Barcelona, Spain, this week, ahead of the upcoming Spring I/O show. I just spent a wonderful week in amazing England, meeting old friends, speaking at Devoxx UK, etc. A Bootiful Podcast: EasyMock contributor...

Remote Code Execution (RCE)

graphql-upload is vulnerable to remote code execution. The vulnerability exists due to a lack of sanitization of file name via the upload function...

CVE-2022-29353

An arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows attackers to execute arbitrary code via a crafted filename...

CVE-2022-29353

An arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows attackers to execute arbitrary code via a crafted filename...

CVE-2022-29353

An arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows attackers to execute arbitrary code via a crafted filename...

Design/Logic Flaw

An arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows attackers to execute arbitrary code via a crafted filename...

CVE-2022-29353

An arbitrary file upload vulnerability in the file upload module of Graphql-upload v13.0.0 allows attackers to execute arbitrary code via a crafted filename...

CVE-2022-29353

Affected software: Graphql-upload v13.0.0 (Node.js middleware). Vulnerable component: file upload module; root cause: arbitrary file upload via crafted filename enables code execution. Impact: remote code execution with high/critical severity indicators (network vector, no authentication; confide...

Graphql-upload 代码问题漏洞

Graphql-upload is a middleware and upload scalar from the individual developer Jayden Seric in Australia. It is used to add support for GraphQL multi-part requests uploading files via queries and mutations to various Node.js Graphql servers. A security vulnerability exists in Graphql-upload versi...

@airy/maleo (>=0.1.0, <=0.3.1-canary.36), @ardatan/graphql-to-config-schema (>=0.1.19, <=0.1.20) +50 more potentially affected by CVE-2022-1650 via eventsource (>=1.0.1, <=1.1.0)

eventsource NPM version =1.0.1, =0.1.0, =0.1.19, =1.1.1, =0.6.0-beta-1, =2.0.1-alpha.18, =4.1.1-alpha-0188b2d.0, =0.4.5-alpha-4d4e438.0, =0.0.5-alpha-cc593a47.0, =0.8.2-alpha-4c2d524a.0, =0.5.2, =0.0.1, =0.0.1, =6.2.8-alpha-006f5787.0, =6.5.1-alpha-3f7e98ee.0, =6.10.0-alpha-a4628cc4.0 -...

Improper Access Control in wp-graphql

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site...

GHSA-W3XG-7Q6M-3XWP Improper Access Control in wp-graphql

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site...

CVE-2019-25060 WP-GraphQL < 0.3.5 - Improper Access Control

The WPGraphQL WordPress plugin before 0.3.5 doesn't properly restrict access to information about other users' roles on the affected site. Because of this, a remote attacker could forge a GraphQL query to retrieve the account roles of every user on the site...

WordPress plugin WPGraphQL 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin WPGraphQL versions prior to 0.3.5 are vulnerable to an access control error that...

CVE-2022-30288

Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors...

CVE-2022-30288

Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors...

Design/Logic Flaw

DISPUTED Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors."...

CVE-2022-30288

Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors...

CVE-2022-30288

CVE-2022-30288 affects Agoo (Ruby HTTP server). The vulnerability arises in versions before 2.14.3 where GraphQL fragment spreads that form cycles are not rejected, potentially causing an application crash. Multiple validated sources (NVD, Red Hat, OSV, CVE lists, PT Security, CNNVD) confirm the ...

CVE-2022-30288

Agoo before 2.14.3 does not reject GraphQL fragment spreads that form cycles, leading to an application crash. NOTE: the vendor has disputed this on the grounds that it is not the server's responsibility to "enforce all the various ways a developer could write code with logic errors...